[Feature]: Centralized Cryptographic Audit Logging & Immutable Trails

[ErebAsh]

• closes[Feature]: Centralized Cryptographic Audit Logging & Immutable Trails #2059

Description

Implemented Cryptographic Audit Logging to ensure enterprise-grade data integrity and compliance (SOC2, GDPR). This update cryptographically chains every audit log entry to the previous one, making it mathematically impossible to alter historical financial or HR data without breaking the chain and leaving tamper-evident trails.

Changes Made

• Cryptographic Utilities: Added cryptoAudit.js to handle deterministic SHA-256 payload hashing and HMAC signing using a system secret.
• Audit Sequence Logic: Updated audit.service.js to fetch the previous log's hash, compute the new cryptographic sequence, and apply the HMAC signature securely with a retry mechanism to mitigate concurrent insertion conflicts.
• Model Enhancements: Expanded the AuditLog Mongoose schema to track currentHash and signature for strict integrity tracking.
• Verification Service: Introduced auditIntegrity.service.js to rebuild and verify a tenant's complete audit chain from the genesis block, detecting any signs of database tampering.
• Compliance API: Exposed a new verifyAuditTrailIntegrity endpoint in the audit controller to generate integrity reports on demand.

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my feature works

[vercel]

@ErebAsh is attempting to deploy a commit to the Dev's projects Team on Vercel.

A member of the Team first needs to authorize it.